ci: install npm >=11.5.1 so pnpm can do OIDC trusted publishing#18
Merged
Conversation
The 2.0.0 publish reached the registry and signed provenance, but the final PUT returned E404 — pnpm published unauthenticated. `changeset publish` invokes `pnpm publish`, and pnpm delegates the npm OIDC trusted-publishing token exchange to the npm CLI, which must be >= 11.5.1. GitHub's Node 22 runner ships npm 10.x, which can't perform the exchange, so no credentials reached the registry. Install npm@latest before publishing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to #17. That PR got us most of the way: the last Release run authenticated via OIDC and signed provenance to the Sigstore transparency log — but the final
PUT https://registry.npmjs.org/vlurpreturnedE404 Not Found, i.e. pnpm published unauthenticated.Root cause
changeset publishshells out topnpm publish, and pnpm delegates the npm OIDC trusted-publishing token exchange to the npm CLI, which must be ≥ 11.5.1 (npm docs; cf. pnpm#9812 → "ensure npm@11 is installed for OIDC publishing").GitHub's Node 22 runner ships npm 10.x, which can't perform the exchange. Provenance still signed because that uses the GitHub OIDC id-token directly via Sigstore — independent of registry auth — which is why we saw a signed attestation and a 404.
Fix
Add one step before publish:
Result
Merging this runs the Release workflow again. With
package.jsonstill at2.0.0(npm latest1.2.0) and no pending changesets,pnpm changeset publishwill perform the OIDC exchange via npm >=11.5.1 and publishvlurp@2.0.0with provenance, then tagv2.0.0.